diff --git a/internal/netemx/oohelperd.go b/internal/netemx/oohelperd.go
index 9baa2588f..4947bd951 100644
--- a/internal/netemx/oohelperd.go
+++ b/internal/netemx/oohelperd.go
@@ -3,14 +3,12 @@ package netemx
 import (
 	"fmt"
 	"net/http"
-	"net/http/cookiejar"
 
 	"github.com/ooni/netem"
 	"github.com/ooni/probe-cli/v3/internal/logx"
 	"github.com/ooni/probe-cli/v3/internal/model"
 	"github.com/ooni/probe-cli/v3/internal/netxlite"
 	"github.com/ooni/probe-cli/v3/internal/oohelperd"
-	"golang.org/x/net/publicsuffix"
 )
 
 // OOHelperDFactory is the factory to create an [http.Handler] implementing the OONI Web Connectivity
@@ -21,7 +19,7 @@ var _ HTTPHandlerFactory = &OOHelperDFactory{}
 
 // NewHandler implements QAEnvHTTPHandlerFactory.NewHandler.
 func (f *OOHelperDFactory) NewHandler(env NetStackServerFactoryEnv, unet *netem.UNetStack) http.Handler {
-	netx := netxlite.Netx{Underlying: &netxlite.NetemUnderlyingNetworkAdapter{UNet: unet}}
+	netx := &netxlite.Netx{Underlying: &netxlite.NetemUnderlyingNetworkAdapter{UNet: unet}}
 	handler := oohelperd.NewHandler()
 
 	handler.BaseLogger = &logx.PrefixLogger{
@@ -46,29 +44,26 @@ func (f *OOHelperDFactory) NewHandler(env NetStackServerFactoryEnv, unet *netem.
 	}
 
 	handler.NewHTTPClient = func(logger model.Logger) model.HTTPClient {
-		cookieJar, _ := cookiejar.New(&cookiejar.Options{
-			PublicSuffixList: publicsuffix.List,
-		})
-		// TODO(https://github.com/ooni/probe/issues/2534): NewHTTPTransportStdlib is QUIRKY but we probably
-		// don't care about using a QUIRKY function here
-		return &http.Client{
-			Transport:     netx.NewHTTPTransportStdlib(logger),
-			CheckRedirect: nil,
-			Jar:           cookieJar,
-			Timeout:       0,
-		}
+		return oohelperd.NewHTTPClientWithTransportFactory(
+			logger,
+			func(dl model.DebugLogger, r model.Resolver) model.HTTPTransport {
+				dialer := netx.NewDialerWithResolver(dl, r)
+				tlsDialer := netxlite.NewTLSDialer(dialer, netx.NewTLSHandshakerStdlib(dl))
+				// TODO(https://github.com/ooni/probe/issues/2534): NewHTTPTransport is QUIRKY but
+				// we probably don't care about using a QUIRKY function here
+				return netxlite.NewHTTPTransport(dl, dialer, tlsDialer)
+			},
+		)
 	}
 
 	handler.NewHTTP3Client = func(logger model.Logger) model.HTTPClient {
-		cookieJar, _ := cookiejar.New(&cookiejar.Options{
-			PublicSuffixList: publicsuffix.List,
-		})
-		return &http.Client{
-			Transport:     netx.NewHTTP3TransportStdlib(logger),
-			CheckRedirect: nil,
-			Jar:           cookieJar,
-			Timeout:       0,
-		}
+		return oohelperd.NewHTTPClientWithTransportFactory(
+			logger,
+			func(dl model.DebugLogger, r model.Resolver) model.HTTPTransport {
+				qd := netx.NewQUICDialerWithResolver(netx.NewUDPListener(), dl, r)
+				return netxlite.NewHTTP3Transport(dl, qd, nil)
+			},
+		)
 	}
 
 	return handler
diff --git a/internal/oohelperd/handler.go b/internal/oohelperd/handler.go
index a18a2da11..989e3a4da 100644
--- a/internal/oohelperd/handler.go
+++ b/internal/oohelperd/handler.go
@@ -80,14 +80,14 @@ func NewHandler() *Handler {
 		NewHTTPClient: func(logger model.Logger) model.HTTPClient {
 			// TODO(https://github.com/ooni/probe/issues/2534): the NewHTTPTransportWithResolver has QUIRKS and
 			// we should evaluate whether we can avoid using it here
-			return newHTTPClientWithTransportFactory(
+			return NewHTTPClientWithTransportFactory(
 				logger,
 				netxlite.NewHTTPTransportWithResolver,
 			)
 		},
 
 		NewHTTP3Client: func(logger model.Logger) model.HTTPClient {
-			return newHTTPClientWithTransportFactory(
+			return NewHTTPClientWithTransportFactory(
 				logger,
 				netxlite.NewHTTP3TransportWithResolver,
 			)
@@ -218,8 +218,9 @@ func newCookieJar() *cookiejar.Jar {
 	}))
 }
 
-// newHTTPClientWithTransportFactory creates a new HTTP client.
-func newHTTPClientWithTransportFactory(
+// NewHTTPClientWithTransportFactory creates a new HTTP client
+// using the given [model.HTTPTransport] factory.
+func NewHTTPClientWithTransportFactory(
 	logger model.Logger,
 	txpFactory func(model.DebugLogger, model.Resolver) model.HTTPTransport,
 ) model.HTTPClient {